CVE-2026-74928 Overview
CVE-2026-74928 affects the Project Manager plugin for WordPress in versions prior to 4.0.7. The plugin exposes import routes without any authorization check. Unauthenticated attackers can invoke these routes to create WordPress user accounts with attacker-chosen passwords. The flaw bypasses the site's own registration setting, allowing account creation even when public registration is disabled. The weakness is categorized as Missing Authorization [CWE-862].
Critical Impact
Unauthenticated attackers can create WordPress accounts with known passwords, giving them a persistent foothold on affected sites regardless of the registration policy.
Affected Products
- Project Manager WordPress plugin versions before 4.0.7
- WordPress sites with the vulnerable plugin installed and activated
- Any hosting environment exposing the plugin's import routes to the public internet
Discovery Timeline
- 2026-08-26 - CVE-2026-74928 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74928
Vulnerability Analysis
The Project Manager plugin registers import routes intended for administrators. These routes accept structured input that includes user records. Because the routes omit capability and nonce checks, any HTTP client can reach them. An attacker submits an import payload containing a new user entry with a password of their choosing. The plugin then provisions the account through standard WordPress user creation APIs. The result is a working credential set controlled by the attacker.
Root Cause
The root cause is missing authorization on plugin-registered endpoints. Import handlers do not call current_user_can() or verify a valid nonce before processing input. The plugin trusts request data to determine action rather than the caller's identity. This design allows unauthenticated write operations against user data.
Attack Vector
Exploitation requires only network access to a target site. The attacker sends a crafted HTTP request to the vulnerable import route with a payload defining a new WordPress user. No user interaction, prior authentication, or elevated privilege is needed. The site returns success and the attacker authenticates using the credentials submitted in the payload. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-74928
Indicators of Compromise
- Newly created WordPress user accounts with no corresponding administrative action in audit logs
- HTTP POST requests to Project Manager import endpoints from unauthenticated sources
- User records with recent user_registered timestamps that do not match legitimate onboarding activity
- Access log entries referencing plugin import paths followed by successful wp-login.php authentications from the same source IP
Detection Strategies
- Inventory installed plugins and flag Project Manager versions earlier than 4.0.7
- Alert on WordPress user_register events that occur without an authenticated administrator session
- Correlate web server access logs against the wp_users table to identify accounts created via anonymous requests
Monitoring Recommendations
- Enable WordPress audit logging with user creation and role change events forwarded to a central SIEM
- Monitor for HTTP 200 responses on plugin import routes originating from external IP addresses
- Track first-time logins from new accounts and correlate with recent request patterns to plugin endpoints
How to Mitigate CVE-2026-74928
Immediate Actions Required
- Update the Project Manager plugin to version 4.0.7 or later on all WordPress installations
- Audit the wp_users table for accounts created since the plugin was installed and remove unauthorized entries
- Rotate credentials for any account that cannot be positively attributed to a legitimate user
- Review scheduled tasks, posts, and configuration changes made by suspicious accounts
Patch Information
The vendor addressed the missing authorization in Project Manager version 4.0.7. The fix adds capability and nonce checks to the import routes so that only authenticated administrators can trigger user creation. See the WPScan Vulnerability Report for the advisory reference.
Workarounds
- Deactivate the Project Manager plugin until the update to 4.0.7 or later is applied
- Restrict access to plugin import routes at the web server or WAF layer to trusted administrator IP ranges
- Enforce multi-factor authentication on all administrator accounts to limit the value of stolen or planted credentials
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
